[PATCH 5/5] common/cnxk: fix OOB write in rep count copy

[Jerin Jacob]

On Mon, Nov 2, 2026 at 5:53 PM Aarnav JP <ajp at marvell.com> wrote:
>
> roc_nix_max_rep_count() copied rsp->rep_cnt entries from the get_rep_cnt
> mailbox response into the fixed 64-entry roc_nix->rep_pfvf_map[] without
> validating the AF-supplied count. rep_cnt is a uint16_t, so a malformed
> or malicious AF response could overrun the array (and read past the
> response's 64-entry map), corrupting adjacent driver state.
>
> Reject responses with rep_cnt greater than MAX_PFVF_REP before copying.
>
> Fixes: 162c77c18838 ("common/cnxk: add support for representors")
> Cc: stable at dpdk.org
>
> Signed-off-by: Aarnav JP <ajp at marvell.com>


Series applied to dpdk-next-net-mrvl/for-main. Thanks

> ---
>  drivers/common/cnxk/roc_nix.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/common/cnxk/roc_nix.c b/drivers/common/cnxk/roc_nix.c
> index 8e3903051d..ae6a918682 100644
> --- a/drivers/common/cnxk/roc_nix.c
> +++ b/drivers/common/cnxk/roc_nix.c
> @@ -589,6 +589,12 @@ roc_nix_max_rep_count(struct roc_nix *roc_nix)
>         if (rc)
>                 goto exit;
>
> +       if (rsp->rep_cnt > MAX_PFVF_REP) {
> +               plt_err("Invalid rep_cnt %u in get_rep_cnt rsp", rsp->rep_cnt);
> +               rc = -EIO;
> +               goto exit;
> +       }
> +
>         roc_nix->rep_cnt = rsp->rep_cnt;
>         for (i = 0; i < rsp->rep_cnt; i++)
>                 roc_nix->rep_pfvf_map[i] = rsp->rep_pfvf_map[i];
> --
> 2.43.0
>